ArgentinaLey 25.326, enforcement, sanctions, and the habeas data action
Ley 25.326, arts. 29-43 (supervisory authority, sanctions, and habeas data)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Give the control body the antecedents, documents, programs, or other elements about your personal-data processing that it requests, and let it verify your compliance with the Act, including through a judicially authorized inspection.NIST Privacy FrameworkGV.PO-P5
- Expect the control body to impose a warning, suspension, a fine of one thousand to one hundred thousand pesos, or closure of the file for a violation, graded to the violation's gravity and harm under due process, without prejudice to civil or criminal liability.
- Do not access a personal database without authorization, disclose personal data you are bound to keep secret, or insert data into a personal-data file illegitimately; a heavier penalty applies when the conduct reaches a genetic-data databank or DNA registry.NIST Privacy FrameworkCT.PO-P1
- Register a private-sector code of conduct for personal-data processing practices with the control body before relying on it as your compliance standard.NIST Privacy FrameworkGV.PO-P5
- Expect an affected person, their guardian, or their universal successor to bring a habeas data judicial action against you to learn, correct, delete, or restrict their personal data, and expect the court's judgment to be reported to the control body's own registry.
These lines are LexLint's reading of the law's text. Also read by: Agencia de Acceso a la Información Pública (Resolución AAIP 126/2024, classification of infractions and graduation of sanctions) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Código Penal art. 157 bis, as substituted by Ley 27.759 (2024), punishes unauthorized access to a personal database, disclosure of data one is bound to keep secret, or illegitimate insertion of data, with one month to two years' imprisonment, rising to six months to four years plus two to five years' special disqualification when the conduct reaches a genetic-data databank, DNA registry, examination, or sample; a public officer offender additionally faces one to four years' special disqualification.
Penalty structure
Article 31 sets this statutory range for administrative fines; the enforcement authority's implementing regulation (Resolución AAIP 126/2024, replacing Disposición DNPDP 7/2005 as amended by Resoluciones AAIP 240/2022 and 244/2022) grades it into three severity tiers and caps the aggregate fine for multiple sanctions of identical conduct in one proceeding at five hundred times the applicable tier's maximum fine.
- Rule
- Fixed only
- As of
- Minimum
- 1,000
- Currency
- ARS
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Agencia de Acceso a la Información Pública (AAIP), acting through its Dirección Nacional de Protección de Datos Personales
Settledness
- As of
- Guidance link
- https://servicios.infoleg.gob.ar/infolegInternet/anexos/395000-399999/399750/norma.htm
- Guidance body
- Agencia de Acceso a la Información Pública (Resolución AAIP 126/2024, classification of infractions and graduation of sanctions)
- Open questions
- Does the cap of five hundred times the maximum of the applicable scale in point 7 of Annex II to Resolución AAIP 126/2024 apply only to several fines for "idéntica conducta sancionable" ("identical sanctionable conduct"), or also to fines for different infractions accumulated in the same proceeding?
- Does the control body's power to sanction under Article 31 reach a private database in a province that has not adhered under Article 44, given that Article 44 declares only Chapters I to IV and Article 32 of public order and national application?
What it makes you log
Logging duty
Article 29(1)(d) and (e) let the control body check the integrity and security rules, seek judicial authorization to reach premises, equipment or programs, and demand from public and private bodies the records, documents and programs on their processing; Article 39 lets the court ask for reports on the technical medium and the base documentation. These are powers to demand information, with no record named, so the instrument imposes no record duty and the audit expectation is on request by the regulator. Articles 29(1)(c) and 43(4) have the control body keep its own registers, which are not a controller log. Article 36 sets venue for the habeas data action and is not a territorial scope rule, so no territorial hook is recorded; the scope article, Article 44, is not cited by this row.
- Kind
- None
- As of
What this law does
Article 29.1 charges the control body (the AAIP's Dirección Nacional de Protección de Datos Personales) with assisting and advising people about their rights, issuing the rules the Act requires, keeping a census and permanent registry of databases, controlling compliance with data-integrity and security rules, with judicial authorization to inspect premises, equipment, or processing programs, requesting information and records from public and private entities, imposing the administrative sanctions the Act allows, acting as a private prosecutor in a criminal case the Act's violation brings, and controlling a private reporting database's registration requirements.
Article 30 lets an association or entity representing private-sector database controllers or users draft a professional code of conduct for personal-data processing, and requires the control body to register it, which it may refuse where the code does not conform to the applicable rules.
Article 31 lets the control body impose a warning, suspension, a fine of one thousand to one hundred thousand pesos, or closure of the file, without prejudice to any public-sector administrative liability, civil damages, or criminal sanction, graded to the violation's gravity and harm under due process; the enforcement authority's implementing regulation, Resolución AAIP 126/2024, grades these into three severity tiers and caps the aggregate fine for identical multiple sanctions in one proceeding at five hundred times the applicable tier's maximum.
Article 32 inserted articles 117 bis and 157 bis into the Código Penal; article 157 bis, since substituted by Ley 27.759 in 2024, punishes unauthorized access to, disclosure from, or illegitimate insertion into a personal database with one month to two years' imprisonment. The penalty rises to six months to four years, with a further two to five years' special disqualification from practising the profession, for conduct reaching a genetic-data databank or a DNA record, examination or sample.
Articles 33 to 43 arm an affected person, their guardian, or their universal successor with a habeas data judicial action against a public or private reporting database's controller or user, heard by the judge of the plaintiff's or defendant's domicile or of the place the act had effect, with federal jurisdiction over a national public database or one interconnected across jurisdictions, following the ordinary amparo procedure and, where the record's falsity or inaccuracy is manifest, letting the judge provisionally block the file pending the court's judgment, which must be reported to the control body's own registry.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .